Address review feedback

Co-authored-by: Giuseppe Lo Presti <giuseppe.lopresti@cern.ch>
Signed-off-by: Micke Nordin <kano@sunet.se>

Author: mickenordin

IETF-RFC.md

@@ -1014,10 +1014,7 @@ voluntarily.
     an HTTP POST request to the given `uri` with the resulting bearer
     token in a form field named `access_token` (see
     [Resource Access](#resource-access)).  The shared secret MUST NOT
-    be exposed to the browser and MUST NOT appear in any URI.  In a
-    multi-protocol Share that also offers WebDAV, the access
-    requirements provided in the `webdav` part (such as
-    `must-exchange-token`) MUST apply to `webapp` accesses as well.
+    be exposed to the browser and MUST NOT appear in any URI.
   - OPTIONAL appName (string)
     A human-friendly name of the web application, to be used in user
     interfaces when referring to this Share.

spec.yaml

@@ -935,6 +935,7 @@ components:
                   - read
                 requirements:
                   - must-use-mfa
+                  - must-exchange-tokem                 
                   - must-exchange-token
               webapp:
                 uri: https://apps.example.org/codimd/7c084226-d9a1-11e6-bf26-cec0c932ce01